SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce without authentication but still recommended immediate patching. With a CVSS score of 9.8, this vulnerability was discovered by Inmarsat Government researchers and added to CISA's Known Exploited Vulnerabilities Catalog due to active exploitation in the wild. The complete attack vector requires low complexity and has high impact on confidentiality, integrity, and availability. This vulnerability was later bypassed, leading to CVE-2024-28988 and subsequently CVE-2025-26399. Fixed in version 12.8.3 Hotfix 1. References: https://www.helpnetsecurity.com/2024/08/15/cve-2024-28986/ https://threatprotect.qualys.com/2024/08/18/solarwinds-web-help-desk-whd-java-deserialization-vulnerability-cve-2024-28986/ https://thehackernews.com/2024/08/solarwinds-releases-patch-for-critical.html Remediation: Apply the available patch provided by SolarWinds.
url